Homepage About Snyk

Command Injection Affecting io.jenkins.plugins:cryptomove Open this link in a new tab package, versions [0,]

0.0
high

  • Attack Complexity

    Low

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-IOJENKINSPLUGINS-559574

  • published

    10 Mar 2020

  • disclosed

    9 Mar 2020

  • credit

    Wasin Saengow

Report a new vulnerability Found a mistake?

Introduced: 9 Mar 2020

CWE-78 Open this link in a new tab

How to fix?

There is no fixed version for io.jenkins.plugins:cryptomove.

Overview

io.jenkins.plugins:cryptomove is a Jenkins plugin that sources your keys and secrets stored on CryptoMove and runs a command with your keys and secrets available as environment variables with the name and value.

Affected versions of this package are vulnerable to Command Injection. As part of its build step configuration. It user with Job/Configure permission to execute an arbitrary OS command on the Jenkins master.